Katalog CVE (hal. 958)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.603 (Critical 36.783 · High 106.969 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 47.851–47.900 dari 267.603 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-62683 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser ca...	3.1 Low	—	0,32%	15 Jul 2026
CVE-2026-61828 Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL se...	8.5 High	—	0,15%	15 Jul 2026
CVE-2026-61371 Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive e...	7.5 High	—	0,53%	15 Jul 2026
CVE-2026-60005 f5 nginx gateway fabric, f5 nginx ingress controller +4 lainnya NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a ba...	8.2 High	—	0,74%	15 Jul 2026
CVE-2026-55242 ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger ser...	8.8 High	—	0,20%	15 Jul 2026
CVE-2026-50148 metabase Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metaba...	9.1 Critical	—	0,77%	15 Jul 2026
CVE-2026-50147 metabase Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a...	7.6 High	—	0,34%	15 Jul 2026
CVE-2026-47164 Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP email_verified claim only for new-user creatio...	7.7 High	—	0,45%	15 Jul 2026
CVE-2026-47160 Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's /icons/{domain}/icon.png endpoint used src/http_client.rs checks including sh...	5.8 Medium	—	0,29%	15 Jul 2026
CVE-2026-47159 Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO discovery and pre-validation flow returned organization-related SSO metad...	6.9 Medium	—	0,47%	15 Jul 2026
CVE-2026-47158 Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did not bind the OAuth state parameter accepted by /co...	8.3 High	—	0,25%	15 Jul 2026
CVE-2026-46709 tabby Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the acti...	7.8 High	—	0,25%	15 Jul 2026
CVE-2026-45806 Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app...	7.7 High	—	0,35%	15 Jul 2026
CVE-2026-45805 Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0....	8.8 High	—	0,38%	15 Jul 2026
CVE-2026-45150 Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode,...	6.3 Medium	—	0,31%	15 Jul 2026
CVE-2026-44986 Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitatio...	9.9 Critical	—	0,52%	15 Jul 2026
CVE-2026-41580 stirling pdf Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF T...	6.1 Medium	—	0,27%	15 Jul 2026
CVE-2026-62294 Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and followed symlink...	5.1 Medium	—	0,14%	15 Jul 2026
CVE-2026-61836 monospace directus Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/ut...	8.6 High	—	0,47%	15 Jul 2026
CVE-2026-61835 monospace directus Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL feature can be by...	7.7 High	—	0,41%	15 Jul 2026
CVE-2026-61740 LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset, X-API-Key p...	9.3 Critical	—	0,51%	15 Jul 2026
CVE-2026-61736 LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/a...	9.3 Critical	—	1,4%	15 Jul 2026
CVE-2026-61684 FastGPT is a knowledge-based AI application platform. In 4.15.0-beta4, FastGPT plugin invoke reverse-call endpoints under /api/invoke/* authenticate only by verifying a J...	8.8 High	—	0,39%	15 Jul 2026
CVE-2026-61646 FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta5, FastGPT's shared SSRF guard validates only the initial request URL before handing the request...	6.3 Medium	—	0,36%	15 Jul 2026
CVE-2026-61644 FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api/core/chat/record/getCollectionQuote endpoint authenticates the caller...	7.7 High	—	0,31%	15 Jul 2026
CVE-2026-61613 Cursor is a code editor built for programming with AI. Prior to the Cloud Agent fix on 03/31/2026, browser-enabled Cursor Cloud Agent sessions allowed attacker-controlled...	7.7 High	—	0,68%	15 Jul 2026
CVE-2026-60065 f5 nginx gateway fabric, f5 nginx ingress controller +2 lainnya When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requ...	5.3 Medium	—	0,45%	15 Jul 2026
CVE-2026-60062 f5 nginx agent, f5 nginx instance manager The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory. The conf...	6.4 Medium	—	0,30%	15 Jul 2026
CVE-2026-59762 f5 big-ip next cloud-native network functions, f5 big-ip next for kubernetes +1 lainnya When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance...	7.5 High	—	0,57%	15 Jul 2026
CVE-2026-56434 f5 nginx gateway fabric, f5 nginx ingress controller +2 lainnya NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and...	6.5 Medium	—	0,49%	15 Jul 2026
CVE-2026-55723 f5 nginx ingress controller When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generat...	8.3 High	—	0,51%	15 Jul 2026
CVE-2026-54563 Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2...	7.1 High	—	0,32%	15 Jul 2026
CVE-2026-54562 Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/d...	6.5 Medium	—	0,40%	15 Jul 2026
CVE-2026-54560 Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id claim, so...	7.6 High	—	0,58%	15 Jul 2026
CVE-2026-52865 f5 nginx ingress controller When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportSe...	6.5 Medium	—	0,50%	15 Jul 2026
CVE-2026-42533 f5 nginx gateway fabric, f5 nginx ingress controller +2 lainnya A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables b...	8.1 High	—	6,3%	15 Jul 2026
CVE-2026-33213 redash Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the get_next_path() function in Redash's authentication module stripped the scheme and netlo...	6.1 Medium	—	0,31%	15 Jul 2026
CVE-2026-59838 fortinet fortisiem A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0...	4.8 Medium	—	0,24%	15 Jul 2026
CVE-2026-43637 Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a...	9.1 Critical	—	0,66%	15 Jul 2026
CVE-2026-58559 DoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability.	6.5 Medium	—	0,25%	15 Jul 2026
CVE-2026-58558 Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentiality.	7.8 High	—	0,12%	15 Jul 2026
CVE-2026-58557 Design defect vulnerability in Expedition mode. Impact: Successful exploitation of this vulnerability may affect availability.	4.8 Medium	—	0,10%	15 Jul 2026
CVE-2026-58556 Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability.	5.1 Medium	—	0,11%	15 Jul 2026
CVE-2026-58555 Permission bypass vulnerability in the card module. Impact: Successful exploitation of this vulnerability may affect availability.	6.6 Medium	—	0,12%	15 Jul 2026
CVE-2026-58554 Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.	6.6 Medium	—	0,11%	15 Jul 2026
CVE-2026-58553 Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.	4.0 Medium	—	0,13%	15 Jul 2026
CVE-2026-58552 Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.	5.1 Medium	—	0,13%	15 Jul 2026
CVE-2026-58551 Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.	5.1 Medium	—	0,13%	15 Jul 2026
CVE-2026-58550 Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.	4.0 Medium	—	0,13%	15 Jul 2026
CVE-2026-58549 Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.	4.0 Medium	—	0,13%	15 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.